Expand description
§Trillium handler for x-forwarded-* / forwarded
This simple handler rewrites the request’s host, secure setting, and peer ip based on headers added by a trusted reverse proxy.
The specific headers that are understood by this handler are:
Forwarded
or some combination of the following
There are several ways of specifying when to trust a peer ip address, and the narrowest possible trust rules should be used for a given deployment so as to decrease the chance for a threat actor to generate a request with forwarded headers that we mistakenly trust.
Because the forwarded-for chain is append-only, only its trusted suffix is meaningful: the peer ip is taken from the rightmost entry that is not itself a trusted proxy, walking right to left. Everything to the left of that is under the control of whoever sent the request.
Structs§
- Forwarded
- A rust representation of the forwarded header.
- Forwarding
- Trillium handler for
forwarded/x-forwarded-*headers